PT-2024-13606 · Apache · Apache Drill

Yuzhe Huang · Published 2024-07-24 · Updated 2024-09-10 · CVE-2023-48362

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Drill versions 1.19.0 through 1.21.1

Description The issue allows a user to read any file on a remote file system or execute commands via a malicious XML file. This is due to an XXE vulnerability in the XML Format Plugin.

Recommendations For Apache Drill versions 1.19.0 through 1.21.1, upgrade to version 1.21.2 to fix the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-48362

GHSA-V62G-JWJ9-RFVX

Affected Products

Apache Drill

References · 11

• https://osv.dev/vulnerability/CVE-2023-48362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48362 · Security Note
• https://osv.dev/vulnerability/GHSA-v62g-jwj9-rfvx · Vendor Advisory
• https://lists.apache.org/thread/9tt0q4bdjwgw0dz0l9knqxjnpb5y6zsl · Vendor Advisory
• https://github.com/apache/drill/commit/0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3 · Note
• https://github.com/apache/drill · Note
• https://t.me/cvenotify/87214 · Telegram Post
• https://issues.apache.org/jira/browse/DRILL-8461 · Note
• http://openwall.com/lists/oss-security/2024/07/24/3 · Note
• https://t.me/cvenotify/94033 · Telegram Post
• https://t.me/cvedetector/1553 · Telegram Post